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RULES  AND  REGULATIONS 


Title  28 — ^Judicial  Administration 
CHAPTER  I— DEPARTMENT  OF  JUSTICE 

Part  22 — ConfMentiality  of  Identifiable 
Research  and  Statistical  Information 

Regiilations  governing  confidentiality 
of  research  and  statistical  informaticm 
collected  in  LEAA-fimded  projects  have 
been  prepared  to  implement  lotion  524 
(a)  of  the  Omnibus  Crime  Control  and 
Safe  Streets  Act  of  1968,  as  amended.  In 
g^eral  terms  the  Act  provides  that  re¬ 
search  and  statistical  information  iden¬ 
tifiable  to  a  private  person  may  only  be 
used  for  the  purpose  for  which  obtained. 
The  Act  also  provides  that: 

*  *  *  copies  of  information  shall  be  Im¬ 
mune  from  legal  process,  and  shall  not,  with¬ 
out  the  consent  of  the  person  furnishing 
such  Informahon,  be  admitted  as  evidence  or 
used  for  any  purpose  in  any  action,  suit,  or 
other  judicial  or  administrative  proceedings. 

The  concern  over  confidentiality  of 
research  and  statistical  data  has  become 
increasingly  apparent  during  recent 
years. 

The  growing  trend  toward  use  of  com¬ 
puterized  techniques  for  tabulation  and 
analsrsis  of  data  has  furthered  the  poten¬ 
tial  for  Interfacing,  accessing  and  other¬ 
wise  “using”  data  which  might  otherwise 
ronain  buried  in  volumes  of  “raw  data." 

In  light  of  the  foregoing  the  devel(H>- 
ment  and  implementation  of  appropriate 
confidentiality  procedures  appears  criti¬ 
cal  at  this  time.  The  major  objective  of 
the  LKAA  Regulations  is  to  protect  the 
privacy  of  subjects  included  in  LEAA- 
funded  research  and  statistical  projects. 
Of  equal  importemce,  ttie  regulations 
clarify  the  duty  and  responsibility  of  re¬ 
search  investigators  sumxirted  under 
IjEAA  grants  and  contracts. 

The  regulations,  in  draft  form,  were 
published  in  the  Federal  Register  on 
Sept^nber  24,  1975.  Public  hearings  and 
meetings  on  the  regulations  were  held 
on  October  16. 1975,  and  January  8, 1976. 
These  final  regulations  incorporate  the 
many  recommendations  elicited  during 
the  review  and  commenting  period. 

Pursuant  to  the  authority  vested  in  the 
Law  Enforcement  Assistance  Adminis¬ 
tration  by  sections  501  and  524(a)  of  the 
Omnibus  Chime  Control  and  Safe  Streets 
Act  of  1968,  42  UJS.C.  S701,  et  seq..  as 
amended  (Pub.  L.  90-351,  as  amended  by 
Pub.  L.  93-83,  Pub.  li.  93-415,  Pub.  L.  94- 
430,  and  Pub.  L.  94-503) ,  a  new  Part  22 
is  added  immediat^y  after  Part  21  of 
Chapter  I  of  Title  28,  Chde  of  Federal 
Regulations  to  read  as  set  forth  below: 
Sec. 

22.1  Purpose. 

22.2  Definitions. 

22.20  AppUcabUlty. 

22.21  Use  of  Identifiable  data. 

22.22  Bevelation  of  Identifiable  data. 

22123  Privacy  certification. 

22.24  Information  transfer  agreement. 

2225  Final  dlq>osition  of  identifiable  mate¬ 
rials. 

22.26  Bequests  for  transfer  of  information. 

2227  Notification. 

2228  Use  of  data  Identifiable  to  a  private 

person  fm*  judicial  or  administra¬ 
tive  purposes. 

22.29  Sanctions. 


AuTBoarrr:  Secs.  601,  624(a),  Omnibus 
Crime  CkmtiDl  and  Safe  Streets  Act  of  1968 
(42  UB.C.  3701,  et  seq.) ,  as  amended  (Pub.  L. 
90-361,  as  amended  by  Pub.  L.  93-83,  Pub.  It. 
93-415,  Pub.  L.  94-430.  and  Pub.  L.  94-503). 

§  22.1  Purpose. 

The  purpose  of  these  regulations  is  to: 

(a)  Protect  privacy  of  individuals  by 
requiring  that  information  identifiable  to 
a  private  person  obtained  in  a  research  or 
statistical  program  may  only  be  used 
and/or  revealed  for  the  purpose  for 
which  obtained; 

(b)  Insure  that  copies  of  such  infor¬ 
mation  shall  not,  without  the  consent  of 
the  person  to  whom  the  information  per¬ 
tains,  be  admitted  as  evidence  or  used 
for  any  purpose  in  any  judicial  ad¬ 
ministrative  proceedings; 

(c)  Increase  the  credibility  and  reli¬ 
ability  of  federally-supported  research 
and  statistical  findings  by  minimizing 
subject  concern  over  subsequent  uses  of 
identifiable  information; 

(d)  Provide  needed  guidance  to  per¬ 
sons  engaged  in  research  and  statistical 
activities  by  clarifying  the  purposes  for 
which  identifiable  information  may  be 
used  or  revealed;  and 

(e)  Insure  iqipropriate  balance  be¬ 
tween  individual  privacy  and  essential 
needs  of  the  research  community  for  data 
to  advance  the  state  of  knowledge  in  the 
area  of  criminal  justice. 

§  22.2  Definitions. 

(a)  Person — ^means  any  individual, 
partnership,  corporation,  association, 
public  or  private  organization  or  govern¬ 
mental  entity,  or  combination  thereof. 

(b)  Private  person — means  any  person 
defined  in  §  22.2(a)  other  than  an 
agency,  or  department  of  Federal,  State, 
or  local  government,  or  any  component 
or  combination  thereof.  Included  as  a 
private  person  is  an  individual  acting  in 
his  official  capacity. 

(c)  Research  or  statistical  project — 
means  any  program,  project,  or  compo¬ 
nent  thereof  which  is  supported  in  whole 
or  in  part  with  funds  appropriated  under 
the  Act  and  whose  purpose  is  to  develop, 
measure,  evaluate,  or  otherwise  advance 
the  state  of  knowledge  in  a  particular 
area.  The  term  does  not  include  “intelli¬ 
gence”  or  other  information-gathering 
activities  in  which  information  pertain¬ 
ing  to  specific  individuals  is  obtained  for 
purposes  directly  related  to  enforcement 
of  the  criminal  laws. 

(d)  Research  or  statistical  informa- 
tionT— means  any  Information  which  is 
collected  during  the  conduct  of  a  re¬ 
search  or  statistical  project  and  which  is 
intended  to  be  utilized  for  research  or 
statistical  purposes.  The  term  includes 
information  which  Is  collected  directly 
from  the  individual  or  obtained  from  any 
agency  or  individual  having  possession, 
knowledge,  or  control  thereof. 

(e)  Information  identifiable  to  a  pri¬ 
vate  person — means  information  which 
either — 

(1)  Is  Libelled  by  name  or  other  per¬ 
sonal  identifiers,  or 

(2)  Can,  by  virtue  of  sample  size  or 
other  factors,  be  reasonably  Interpreted 


as  referring  to  a  particular  private 
person. 

(f )  Recipient  of  assistance — ^means  any 
recipient  of  a  grant,  contract,  inter¬ 
agency  agreement,  subgrant,  or  subcon¬ 
tract  under  the  Act  and  any  person,  in¬ 
cluding  subcontractors,  employed  by  such 
recipient  in  connection  with  perform¬ 
ances  of  the  grant,  contract,  or  inter¬ 
agency  agreement. 

(g)  Officer  or  employee  of  the  Federal 
Government — means  any  person  em¬ 
ployed  as  a  regular  or  special  employee 
of  the  U.S.  (including  experts,  consult¬ 
ants,  and  advisory  board  members)  as 
of  July  1, 1973,  or  at  any  time  thereafter. 

(h)  The  act — means  the  Omnibus 
Crime  Control  and  Safe  Streets  Act  of 
1968,  42  U.S.C.  3701,  et  seq.,  as  amended. 

(i)  Applicant — ^means  any  person  who 
applies  for  a  grant,  contract,  or  subgrant 
to  be  fimded  pursuant  to  the  Act. 

§  22.20  Applicability. 

(a)  These  regulations  govern  use  and 
revelation  of  research  and  statistical  in¬ 
formation  obtained,  collected,  or  pro¬ 
duced  either  directly  by  LEAA  or  under 
any  interagency  agreement,  grant,  con¬ 
tract,  or  subgrant  awarded  under  the 
Act. 

(b)  The  regulations  do  not  apply  to 
any  records  from  which  identifiable  re¬ 
search  or  statistical  information  was 
originally  obtained;  or  to  any  records 
which  are  designated  under  existing 
statutes  as  public;  or  to  any  information 
extracted  from  any  records  designated 
as  public. 

(c)  The  regulatiCMis  do  not  apply  to  in¬ 
formatics  gained  regarding  future 
criminal  conduct. 

§  22.21  U(4C  of  identifiable  data. 

Research  or  statistical  Information 
Identifiable  to  a  private  person  may  be 
used  only  for  research  or  statistical  pur¬ 
poses. 

§  22.22  Revelation  of  identifiable  data. 

(a)  Except  as  noted  in  paragraph  (b) , 
of  ttiis  section,  research  and  statistical 
information  relating  to  a  private  perscoi 
may  be  revealed  in  identifiable  form  on 
a  need-to-know  basis  only  to  — 

(1)  Officers,  employees,  and  subcon¬ 
tractors  of  the  recipient  of  assistance; 

(2)  Such  individuals  as  needed  to  im¬ 
plement  sections  303(a)  (12).  402(c), 
515(a) ,  518,  and  521  of  the  Act;  and 

(3)  Peraons  or  organizations  for  re¬ 
search  or  statistical  purposes.  Informa¬ 
tion  may  cmly  be  transferred  for  such 
purposes  upon  a  clear  demonstration 
that  the  standards  of  S  22.26  have  been 
met  and  that,  except  where  information 
is  transferred  under  paragraph  (a)(1) 
and  (2)  of  this  section,  such  transfers 
shall  be  conditioned  on  (X)mpliance  with 
a  8  22.24  agreement. 

(b)  Information  may  be  revealed  in 
identifiable  form  where  prior  consent  is 
chtalned  from  an  individual  or  where  the 
individual  has  agreed  to  participate  in  a 
project  with  knowledge  that  the  find¬ 
ings  cannot,  by  virtue  of  sample  size,  or 
unicjuenees  of  subject,  be  expected  to  to¬ 
tally  conceal  subject  Identity. 
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§  22.23  Privacy  certification. 

(a)  Each  applicant  for  LEAA  support 
either  directly  or  under  a  State  plan 
shall  submit  a  Privacy  Certificate  as  a 
condition  of  approval  of  a  grant  ai>pllca- 
tion  or  contract  proposal  which  has  a 
research  or  statistical  project  component 
under  which  information  identifiable  to 
a  private  person  will  be  collected. 

(b)  The  Privacy  Certificate  shall 
briefly  describe  the  project  and  shall 
contain  assurance  by  the  applicant  that: 

(1)  Data  identifiable  to  a  private  per¬ 
son  will  not  be  used  or  revealed,  except 
as  authorized  under  §§  22.21,  22.22. 

(2)  Access  to  data  will  be  limited  to 
those  employees  having  a  need  therefore 
and  that  such  persons  shall  be  advised 
oi  and  agree  in  writing  to  comply  with 
these  regulations. 

(3)  All  subcontracts  which  require  ac¬ 
cess  to  identifiable  data  will  contain  con¬ 
ditions  meeting  the  requirements  of 
S  22.24. 

(4)  To  the  extent  required  by  S  22.27 
any  private  persons  from  whom  identifi¬ 
able  data  are  collected  or  obtained,  either 
orally  or  by  means  of  written  question¬ 
naire,  shall  be  advised  that  the  data  will 
only  be  used  or  revealed  for  research  or 
statistical  purposes  and  that  compliance 
with  requests  for  information  is  not 
mandatory.  Where  the  notification  re¬ 
quirement  is  to  be  waived,  pursuant  to 
§  22.27(c),  a  justification  must  be  in¬ 
cluded  in  the  Privacy  Certificate. 

(5)  Adequate  precautions  will  be  taken 
to  insure  administrative  and  physical 
security  of  Identifiable  data. 

(6)  A  log  will  be  maintained  indicat¬ 
ing  that  identifiable  data  have  been 
transmitted  to  persons  other  than  LEAA 
or  grantee/contractor  staff  or  subcon¬ 
tractors.  that  such  data  have  been  re¬ 
turned,  or  that  alternative  arrangements 
have  been  agreed  upon  for  futiue  main¬ 
tenance  of  such  data. 

(7)  Project  plans  will  be  designed  to 
preserve  anonymity  of  private  persons  to 
whom  information  relates,  including, 
where  appropriate,  name-stripping,  cod¬ 
ing  of  data,  or  other  similar  procedures. 

(8)  Project  findings  and  reports  pre¬ 
pared  for  dissemination  will  not  con¬ 
tain  information  which  can  reasonably 
be  expected  to  be  Identifiable  to  a  ix*ivate 
person  except  as  authorized  under 
i  22.22. 

(c)  The  applicant  shall  attach  to  the 
Privacy  Certification  a  description  of 
physical  and/or  administrative  proce¬ 
dures  to  be  followed  to  Insure  the  secu¬ 
rity  of  the  data  to  meet  the  requirements 
of  §  22.25. 

§  22.24  Information  transfer  agree¬ 
ment. 

Prior  to  ihe  transfer  of  any  identifi¬ 
able  information  to  persons  other  than 
LEAA  or  project  staff,  an  agreement  shall 
be  entered  into  which  shall  provide,  as 
a  minimum,  that  the  recipient  of  data 
agrees  that: 

(a)  Information  identifiable  to  a  pri¬ 
vate  persOT  will  be  used  only  for  re¬ 
search  and  statistical  purposes. 


(b)  Information  Identifiable  to  a  pri¬ 
vate  person  will  not  be  revealed  to  any 
person  for  any  purpose  except  where  the 
Ixiformatlon  has  already  been  included  in 
research  findings  (and/or  data  bases) 
and  is  revealed  on  a  need-to-know  basis 
for  research  or  statistical  purposes,  pro¬ 
vided  that  such  transfer  is  approved  by 
the  person  providing  information  imder 
the  agreement,  or  authorized  xuider 
S  22.24(e) . 

(c)  Knowingly  and  willfully  using  or 
disseminating  Informatkm  contrary  to 
the  provisions  of  the  agreem^t  shall 
constitute  a  violation  of  these  r^aila~ 
tions,  punishable  in  accordance  with  the 
Act. 

(d)  Adequate  administrative  and 
physical  precautions  will  be  taken  to  as¬ 
sure  secimity  of  information  obtained  for 
such  purpose. 

(e)  Access  to  Information  will  be 
limited  to  those  employees  or  subcwi- 
tractors  having  a  need  therefore  in  con¬ 
nection  with  performance  of  the  activity 
for  which  obtained,  and  that  such  per¬ 
sons  shall  be  advi^  of,  and  agree  to 
comply  with,  these  regulations. 

(f)  Project  plans  will  be  designed  to 
preserve  anonymity  of  private  persons  to 
whom  information  relates,  including, 
where  appropriate,  required  name-strip¬ 
ping  and/or  coding  of  data  or  other 
similar  procedures. 

(g)  Project  findings  and  reports  pre¬ 
pared  for  dissemination  will  not  contain 
information  which  can  reasonably  be  ex¬ 
pected  to  be  identifiable  to  a  private 
person. 

(h)  Information  identifiable  to  a  pri¬ 
vate  person  (obtained  in  accordance 
with  this  agreement)  will,  unless  other¬ 
wise  agreed  upon,  be  returned  up(Hi  com¬ 
pletion  of  the  project  for  which  obtained 
and  no  copies  of  that  information 
retained. 

§  22.25  Final  disposition  of  identifiable 
materials. 

Up<Hi  completion  of  a  research  or  sta¬ 
tistical  project  the  security  of  identifi¬ 
able  research  or  statistical  information 
shall  be  protected  by: 

(a)  Complete  physical  destructiem  of 
all  copies  of  the  materials  or  the  identifi¬ 
able  portion  of  such  materials  after  a 
three-year  required  recipient  retention 
period  or  as  soon  as  authorized  by  law, 
or 

(b)  Removal  of  identifiers  from  data 
and  separate  maintenance  of  a  nam^- 
code  index  in  a  secure  location. 

The  Privacy  Certificate  shall  indicate 
the  procedures  to  be  followed  and  shall, 
in  the  case  of  paragraph  (b)  of  this  sec¬ 
tion,  describe  procedures  to  secure  the 
name  index. 

§  22.26  Requests  for  transfer  of  in¬ 
formation. 

(a)  Requests  for  transfer  of  informa¬ 
tion  identifiable  to  an  individual  Rha.li  be 
submitted  to  the  person  submitting  the 
Privacy  Certificate  pursuant  to  S  22.23. 

(b)  Except  where  information  is  re¬ 
quested  by  LEIAA,  the  request  sluUl  de¬ 


scribe  the  general  objectives  of  the  proj¬ 
ect  for  which  Information  is  requested, 
and  specifically  Justify  the  need  for  such 
information  in  identifiable  form.  The  re¬ 
quest  shall  also  indicate,  and  provide 
justification  for  the  concliision  that  con¬ 
duct  of  the  project  will  not,  either  di¬ 
rectly  or  IndlrecUy,  cause  legal,  economic, 
physical,  or  social  harm  to  individuals 
whose  identification  is  revealed  in  the 
transfer  of  information. 

(c)  Data  may  not  be  transferred  pur¬ 
suant  to  this  section  where  a  clear  show¬ 
ing  of  the  criteria  set  forth  above  is  not 
made  by  the  person  requesting  the  data. 

§  22.27  Notification. 

(a)  Any  person  from  whom  informa¬ 
tion  idaitifiable  to  a  private  person  is  to 
be  obtained  directly,  either  orally,  by 
questionnaire,  or  other  written  docu¬ 
ments,  shall  be  advised: 

(1)  That  the  information  will  only  be 
used  or  revealed  for  research  or  statis¬ 
tical  purposes;  and 

(2)  That  compliance  with  the  request 
for  information  is  entirely  voltmtary  and 
may  be  terminated  at  any  time. 

(b)  Except  as  noted  in  paragraph  (c) 
of  this  section,  where  information  is  to 
be  obtained  through  observation  of  indi¬ 
vidual  activity  or  performance,  such  indi¬ 
viduals  shall  be  advised : 

(1)  Of  the  particular  types  of  Informa¬ 
tion  to  be  collected; 

(2)  That  the  data  will  only  be  utilized 
or  revealed  for  research  or  statistical 
purposes;  and 

(3)  That  participation  in  the  project 
in  question  Is  voluntary  and  may  be  ter¬ 
minated  at  any  time. 

(c)  Notification,  as  described  in  para¬ 
graph  (b)  of  this  section,  may  be  elim¬ 
inated  where  information  Is  obtained 
through  field  observation  of  individual 
activity  or  performance  and  in  the  judg¬ 
ment  of  the  researcher  such  notification 
is  impractical  or  may  seriously  Impede 
the  progress  of  the  research. 

(d)  Where  findings  in  a  project  can¬ 
not.  by  virtue  of  sample  size,  or  imique- 
ness  of  subject,  be  expected  to  totally 
conceal  subject  identity,  an  individual 
shall  be  so  advised. 

§  22.28  Use  of  data  identifiable  to  a 
private  person  for  judicial  or  ad¬ 
ministrative  purposes. 

(a)  Copies  of  research  or  statistical  in¬ 
formation  identifiable  to  a  private  per¬ 
son  shall  be  immtme  from  legal  process 
and  shall  only  be  admitted  as  evidence  or 
used  for  any  purpose  in  any  action,  suit, 
or  other  judicial  or  administrative  pro¬ 
ceeding  with  the  written  consent  of  the 
individual  to  whom  the  data  pertains. 

(b)  Where  consent  is  obtained,  such 
consent  shall; 

(1)  Be  obtained  at  the  time  that  in¬ 
formation  is  sought  for  use  in  judicial  or 
administrative  proceedings; 

(2)  Set  out  specific  purposes  in  connec-- 
tlon  with  which  information  will  be  used; 

(3)  Limit,  where  appropriate,  the 
scope  of  the  Information  subject  to  such 
consent. 
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§  22.29  Sanctions.  , 

Where  LEAA  believes  that  a  violation 
has  occurred  of  section  524(a) .  these  reg> 
ulations.  or  any  grant  or  contract  con¬ 
ditions  entered  into  thereunder,  it  may 
initiate  administrative  actions  leading 
to  termination  of  a  grant  or  contract, 
cc»nmence  appropriate  personnel  and/or 
other  procedures  in  cases  Involving  Fed¬ 
eral  employees,  and/or  initiate  appro¬ 
priate  legal  actions  leading  to  imposition 
of  a  fine  of  not  to  exceed  $10,000  against 
smy  person  responsible  for  such  viola¬ 
tions. 

Effective  date:  January  14,  1977. 

Richard  W.  Velde, 
Administrator,  Law  Enforcement 
Assistance  Administration. 

COMMZNTART 

Section  ZZJ2  Definitions,  (a)  Based  on 
Administrative  Procedures  Act,  5  U.S.C.  661, 
(APA)  definition. 

(b)  Under  the  proposed  definition,  all 
“Individuals’*  are  “private  persons”  (e.g..  no 
distinction  Is  made  between  an  “individual’* 
Mtlng  In  a  “private”  as  opposed  to  “official” 
capacity).  ’This  is  consistent  with  the  ap¬ 
proach  loUowed  In  the  APA  definition  of 
"person,”  in  which  a  private/pubUc  distinc¬ 
tion  is  made  with  respect  to  organizations, 
but  does  not  apply  to  "Individuals.”  Note, 
therefore,  that  the  regulations  would  limit 
use  and  revelation  of  data  concerning  on- 
duty  activity  of  public  olficialB,  such  as  police 
officers,  where  such  data  was  obtained  for 
a  research  or  statistical  purpose. 

(c)  No  comment. 

(d)  No  comment. 

(e)  Definition  follows  concept  used  by 
Bureau  of  the  Census. 

(f)  Definition  covers  subcontractors  be¬ 
low  the  primary  level.  This  Is  necessary  to 
cover  multi-level  statistical  projects. 

(g)  No  comment. 

(h)  No  comment. 

(1)  Noc<Mhment. 

Section  2220  Applicability,  (a)  The  pro¬ 
cedural  requirements  of  the  regtilatlons  (e.g.. 
privacy  oertlflcates,  transfer  agreements)  are 
applicable  to  all  projects  which  are  awarded 
after  the  effective  date  of  the  regulations. 
The  statutory  provisions  of  section  624(a) 
of  the  Act,  however,  apply  to  all  programs 
outstanding  as  of  the  effective  date  oi  the 
Act. 

(b)  The  exemption  in  this  paragnq>h  In¬ 
sures  that  limitations  of  the  regulations  are 
not  extended  to  cover  the  original  files  from 
which  data  was  obtained  (e.g..  data  In  such 
records  may  continue  to  be  used  for  any 
otherwise  authmized  purpose)  or  to  records 
which  are  designated  as  public  or  data  col¬ 
lected  therefrom. 


(c)  The  regtilations  do  not  apply  to  Infor¬ 
mation  relating  to  futiue  criminal  activity. 

Section  2221  Vee  of  Identifiable  Data. 
Under  this  provision,  the  limitation  on  use 
of  Identifiable  Information  would  be  appli¬ 
cable-regardless  of  whether  data  collec¬ 
tion  activity  was  paid  out  of  LEAA  or  match 
funds.  This  position  Is  Justified  in  the  fact 
that  section  624(a)  refers  to  information 
“ffimished  \mder  the  Act” — ^rather  than  to 
specific  information  which  is  obtained  with 
LEAA  funds. 

Section  2222  Revelation  of  Identifiable 
Data.  This  section  would  allow  revelation  of 
identifiable  inf<u*mstlon  to  LEAA  and  SPA 
program,  audit  or  evaluation  staff,  to  the 
Comptroller  General  of  the  U.S.,  and  to  other 
persons  for  research  and  statistics  piuposes 
(on  condition  of  compliance  with  i  22.24 
agreement).  Note  that  Identifiable  informa*- 
tion  could  be  used  or  revealed  for  any  re¬ 
search  or  statistical  purpose  regardless  of 
whether  or  not  It  was  related  to  the  specific 
objectives  in  the  <Higlnal  project.  Data  co\ild 
also  be  revealed  where  consent  had  been  pro¬ 
vided  by  the  individual  or  could,  by  virtue  of 
sample  size  or  unique  characteristics  of  the 
subject,  be  inferred  from  voluntary  participa¬ 
tion  in  a  project.  ’This  would  cover,  for  ex¬ 
ample,  the  evaluation  of  ^>ecific  organiza¬ 
tions  and  subsequent  relefise  of  evaluation 
results  which  were  Identifiable  to  the  organi¬ 
zation  in  question. 

The  “need-to-know”  limitation  would  pre¬ 
clude  release  of  lnformati<Hi  In  identifiable 
form  for  longitudinal  or  other  similar  studies, 
when  the  objectives  of  such  subsequent  proj¬ 
ects  could  be  attained  through  use  of  names 
stripped  and/or  coded  data. 

The  “need-to-know”  limitation  would  also 
prohibit  inclusion  of  Identifiable  data  In 
publications  or  reports  prepared  for  general 
dissemination. 

Data  could  be  revealed  in  symposia  or  other 
research-oriented  meetings,  however  (if 
needed  in  Identifiable  form),  provided  that 
participants  entered  into  |  22.24  agreements. 
Note  that  since  agreements  do  not  require 
LEAA  review  or  approval  tiie  procedure 
should  not  present  undue  administrative 
burdens.  (Although  it  should  have  the  effect 
of  curtailing  "casual”  dissemination  of  data 
and  reinforcing  awareness  of  confidentiality 
criteria. 

Section  2223  Privacy  Certification.  A 
Privacy  Certification  would  be  required  to  be 
submitted  by  potential  grantees,  contractors, 
or  subgrantees  In  any  case  in  which  a  pro¬ 
posed  project  Included  a  research  or  statisti¬ 
cal  component. 

Note  that  subcontractors  are  not  required 
to  comply  with  this  requlrwuent  (but  are 
bound  by  agreements,  as  defined  under 
I  2224) . 

Section  2224  Information  Transfer  Agree¬ 
ment.  Hie  agreement  is  Intended  to  Insure 
that  transferred  data  remain  subject  to  pri¬ 
vacy  protections  the  regulations. 


Specifically,  the  agreement  would  require 
that  physical  and  administrative  security  of 
data  be  insured  (including  use  of  need-to- 
know  limits  on  access  by  employees  and  sub¬ 
contractors)  and  that  records  of  Identifiable 
information  obtained  under  the  agreement  be 
returned  without  copies  retained  (unless* 
otherwise  agreed  to  by  the  party  providing 
the  information  under  the  agreement) . 

In  the  event  that  more  restrictive  rules, 
would  apply,  such  as  41  CFR  Fart  2,  such 
limitations  would  be  considered  as  part  of  the 
agreement. 

Section  22.25  Final  Disposition  of  Identi¬ 
fiable  Materials.  This  section  allows  final  pro¬ 
tection  of  data  to  be.  accomplished  through 
destruction  of  either  the  entire  reocu'd  or  that 
portion  which  includes  the  identifiers  or 
through  substitution  of  code  numbers  and 
separate  maintenance  of  a  name-code  index. 
LEAA  will  determine  whether  proposed  pro¬ 
cedures  for  securing  the  index  are  adequate. 

Section  2226  Request  for  Transfer  of  In¬ 
formation.  This  section  sets  forth  the  stand¬ 
ards  which  must  be  met  prior  to  approval  of 
a  request  for  information. 

Strict  criteria  for  review  of  the  project  for 
which  data  is  requested  have  been  Included 
to  insure  that  such  transfers  of  data  ostensi¬ 
bly  for  research  p\ui>o8es  would  not  harm  the 
Individual  providing  original  data. 

Section  2227  Notification.  Subsections 
(a)  and  (b)  have  been  set  out  separately  to 
distinguish  between  (a)  projects  in  which 
data  is  provided  in  response  to  soeclflc  ques¬ 
tions  and  (b)  projects  In  which  information 
Is  obtained  through  observation  of  subject 
activity. 

Subsection  (c)  permits  waiver  of  the  no¬ 
tification  requirement  where  information  is 
gathered  through  field  observation  and  no¬ 
tification  is  considered  impractical  by  the 
researcher.  Note  that  i  22.23  requires  that 
such  proposed  waivers  be  Justified  in  the 
Privacy  Certification. 

Subsection  (d)  requires  that  persons  be 
advised  in  situations  where  identity  cannot 
be  concealed  because  of  uniqueness  of  sub¬ 
ject  matter  or  because  of  sample  size. 

Section  2222  Use  of  Data  Identifiable  to 
a  Private  Person  for  Judicial  or  Administra¬ 
tive  Purposes.  Section  22.28  sets  out  the  im¬ 
munity  provisions  as  contained  in  the  Act. 
It  should  be  noted  that  such  hnmunlty  is 
specifically  limited  to  copies  of  Information 
(see  {  624(a)). 

Section  22.29  Sanctions.  Sanctions  are 
made  available  against  “any  person  respon¬ 
sible  for  violations.”  This  would  Include  the 
'grantee  organization,  as  well  as  particular 
Individuals  (including  grantee  employees) 
committing  violations.  Actions  against  Fed¬ 
eral  employees  are  based  on  Title  18  UJB.C. 
1906  (prohibiting  disclosures  of  oonfldmitlal 
information) .  Sanctions  for  violation  of  the 
regulations  are  apphcable  to  vkdatians  oc- 
euning  subsequent  to  the  effective  date  of 
the  regulati<Hu. 
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